9.8
Critique
CVE-2026-18366 The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the…
Description
The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticated users to change the password of, escalate to Administrator, or delete any account whose user ID happens to match the ID of one of the Events Manager WordPress plugin before 7.4.1's own posts.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Events Manager 7.1 | 7.1 → < 7.4.1 | 7.4.1 |
Autres CVE de Events Manager
Les 8 CVE de Events Manager →
CVE-2026-93662
The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search…
4.3
Moyenne
CVE-2026-93661
The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers…
2.7
Faible
CVE-2026-18057
The Events Manager WordPress plugin before 7.4.1 does not sanitise and escape a user-controlled value before using it…
8.1
Élevée
CVE-2026-18050
The Events Manager WordPress plugin before 7.4 does not perform any authorization check on a REST route that serves…
7.5
Élevée